An empirical study on vulnerability assessment and penetration detection for highly sensitive networks

2.1 Contribution

The use of penetration testing technology is conducive to the realization of accurate positioning, accurate detection, and active alarm of security vulnerabilities, and the optimization of monitoring and rectification of the combination of network security management control system are analyzed and detailed by the authors in this article. Taking penetration testing technology as one of the core elements of management and control, the risk index model is optimized to make network security management controllable and efficient, and effectively achieve management and control objectives.

3.1 General model of management control

The control work in management is to determine the implementation of the plan according to the standard, and to ensure the correctness and realization of the plan objectives by correcting the deviation in the implementation.

Management control refers to the process in which managers influence other members of an organization to achieve organizational strategy. Management control process helps to achieve a desired goal, e.g., optimized and effective organization planning and coordination of normal work order and management system activities. The purpose of management control is to execute strategy (see Figure 3).

Figure 3

Management control diagram.

3.2 Management control elements

The working process of management control, as shown in Figure 4, generally consists of the following three steps: setting control objectives and establishing performance standards; measure actual work and obtain deviation information; and analyze the cause of the deviation and take corrective action (feedback control).

Feedback control is derived from the theory of automatic signal control. According to the feedback signal, it can be divided into “positive feedback” and “negative feedback.” Feedback control refers to comparing the actual results of a task after completion and judging the impact on the implementation of the next action to play a controlling role [21]. By introducing it into control science, three basic element nodes are set: control target, standard, deviation information, and corrective measures, which form the key node of the whole control closed-loop.

3.3 Penetration test

3.4 Model study

To study the network information penetration technology and penetration detection technology, we plan to establish a simulation model, which consists of the following parts: two networks with different information security levels – A network (high information security level, known controllable network) with B network (low information security level, unknown uncontrollable network); there are n known information channels between A network and B network e 1 , e 2 , … , e n , and m unknown information channels h , 1 h 2 , … , h m ; there are x network entities in A network g 1 , g 2 , … , g x , including u specific information requesters s 1 , s 2 , … , s u ; and there are y network entities in network B f 1 , f 2 , … , f y , including v specific information publishers o 1 , o 2 , … , o v . The specific information requester hopes to obtain specific information from the specific information publisher i, the specific information publisher wants to pass the specific information to the specific information requester, and the two transmit specific information through the specific information access flow (SIF, sensitive information flow) [26,27,28,29]. Specific information access flow has three key characteristics: specific purpose (destination), specific channel (method), and specific content (content). The information filtering system is built on e 1 , e 2 , … , e n . The network information intrusion detection system (NIPDS) identifies and blocks the transmission of suspicious information.

Define the following set:

• S: A collection of specific information visitors, S = { s i } , i = 1 , 2 , … , u ;

• O: A collection of specific information sources, O = { o i } , i = 1 , 2 , … , v ;

• E: Explicit information channel collection, E = { e i } , i = 1 , 2 , … , n .

E is divided into two subsets: the explicit controllable information channel subset EC (NIPDS can identify the information channel in EC and can be controlled) and the explicit uncontrollable information channel subset EU (NIPDS can identify the information channel in EU but unable to control or identify the specific information), E = EC ∪ EU.

Sub-definition: Em = { e i } , i = 1 , 2 , … , v ; e i = 〈 m , oi 〉 ; ECmc = { e i } , i = 1 , 2 , … , v ; e i = 〈 mei = 〈 mc, oi 〉 c , oi 〉 ; EUmu = { e i } , i = 1 , 2 , … , v ; e i = 〈 mu, oi 〉 ; mc is an explicit controllable access method, mu is an explicit uncontrollable access method; H is a collection of open information channels, a collection of information channels that involve human factors or are outside the scope of the current technical system processing capabilities and cannot be controlled by NIPDS:

• H = { h i } , i = 1 , 2 , … , m ; C: specific information collection,

• C = { c i } , i = 1 , 2 , … , w . In this way, the specific information flow SIF of the research object in the penetration detection model can be abstracted into a five-tuple:

  SIF = [ S , O , E , H , C ] = { sif i } , i = 1 , 2 , … , q

• sif i = 〈 s i , o i , e i , h i , c i 〉 , s i ∈ S , o i ∈ O , e i ∈ E , h i ∈ H , c i ∈ C

• SIF can be divided into three subsets:

• CSIF: Controllable specific information flow collection, where SIF adopts explicit controllable information channel, NIPDS can identify and control,

  CSIF = [ S , O , E C , H , C ] ∈ E C ≠ ϕ ;

• USIF: Uncontrollable specific information flow collection, where SIF adopts explicit uncontrollable information channel, CSIF = [ S , O , E U , H , C ] ∈ E U ≠ ϕ ;

• NSIF: Open a collection of specific information streams, where SIF uses an open information channel, CSIF = [S, O, f, H, C]. The goal of the infiltrating party (NIPT) is to make as many S as possible to obtain C, that is, to maximize the number of elements in the SIF set. As the key parameters that determine the size of SIF are the size and characteristics of S, O, and E, the infiltrator adopts micro-disordering methods to try to achieve the goal:

1. For a certain access method m _i , expand the controllable information channel by expanding the size of O E C m i , makes sif i ∈ SIFe i microdisorder on O;

2. Try to use uncontrollable information channels to make usif i ∈ USIF microdisorder on C;

3. Try to use open information channels to make nsif i ∈ NSIF microscopic disorder in S, O, H, C. For NIPDS, the overall goal is to reduce the size of USIF and NSIF.

Sub-goals:

1. Use a man–machine system to monitor open information channels;

2. Try to convert open information channels into explicit information channels, namely H → EU;

3. Turn uncontrollable information channels into controllable information channels, from micro-disorder to macro-order, that is, EU → EC;

4. csif i ∈ CSIF from micro-controllable to macro-controllable.

That is, the information channel can be gradually monitored by the method of step-by-step degradation, and the controllability of information can be improved.

3.5 Monitoring of open information channels

For NIPT, the purpose is to diffuse C into all S. To achieve the above-mentioned means (1), O must be diffused to S through an open channel, so we can monitor those unknown displays by sampling. Suppose that NIPT randomly sends

Assume [ O i ] = p v , 0 < p ≤ 1 , with q sampling points, wherein p is the release ratio. Besides, sampling coverage is calculated as r = f ( p , q ) , 0 < r ≤ 1 , wherein q represents sampling points. According to the principle of probability, we get

Equation (1) can be transformed into a geometric sequence, and then according to the series formula:

According to equation (2), the formula for the number of sampling points can be obtained:

Example: set v = 1,000, random release each time O _i . The number is 3. If you want to obtain 99% coverage, the sampling point needs to be q = ln(1 – 0.99)/ln(1 – 0.003) = 1,535, that is, 1,535 samples need to be sampled; if v = 3,000, then q is 4,605. Another important application of equations (2) and (3) is to estimate the size of the information source O [O]. The q curve is calculated through equation (3) and presented in Figure 5 for the various values of p including v = 1,000 (p = 0.003) and v = The curve of q at 3,000 (p = 0.001).

It can be seen that the curvatures of the two curves are different, and a graph of the q function family is obtained by setting different p values (as shown in Figure 3). Thus, sampling data can be generated after a certain amount of sampling, and the p value can be estimated by comparing the convergence curve of the published source coincidence degree of the sampling data with the q curve, thereby obtaining the approximate value of [O]. A large number of existing curve similarity calculation methods can be used for processing, and other distribution models can also be used for estimation.